Log collecting/analyzing system with separated functions of collecting log information and analyzing the same

ABSTRACT

A log collecting/analyzing system has a log collection terminal device as a client terminal device which collects logs and transmits the collected logs to a log server via a network. The log server receives the transmitted logs and stores the received logs for analysis. According to this configuration, it is possible to obtain useful information, such as information about what play modes are popular in the case of games and so forth, or information about what characters are popular in the case of selecting a character for a game. Therefore, it is possible to make use of the result of log analysis to develop the game.

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority from Japanese Patent ApplicationNo. 2001-167815 filed on Jun. 4, 2001 and No. 2002-8278 filed on Jan.17, 2002, the disclosures of which are hereby incorporated by referenceherein.

BACKGROUND OF THE INVENTION

[0002] The present invention relates to a log collecting/analyzingsystem, a method of log collection, a log collection program, a methodof log analysis, a log analysis program, a log collecting device, a loganalyzing device, a log collection terminal device and a log server, allof which include separated functions of collecting log information andanalyzing the collected log information, and in which the loginformation is collected at a client side and transmitted to a serverside, and the server side stores the log information to analyze.

[0003] Conventional log collecting/analyzing systems are used for thepurpose of observing something in systems for providing certainservices. For instance, if a log collecting/analyzing system is appliedto some on-line system, it is possible to ascertain how unfair access,systems faults or so forth occurred by analyzing the log. In addition,if the log collecting/analyzing system is applied to a WWW (World WideWeb) server, it is possible to record details like what a clientreferred to, when, and what contents by analyzing the log. And, as aresult, it becomes possible to learn the interest level of the user withrespect to the contents for example.

[0004] However, in the conventional log collecting/analyzing systemsdescribed-above, when the contents for servicing are determined first,the contents for observing are also fixed depending on the determinedcontents for servicing. And, as a result, the collected log informationrequires a specialized analysis system. Accordingly, an analyzing systemfor observing the log at the on-line system is entirely different froman analyzing system for the log of the WWW server, for instance.

[0005] In addition, as for the method of log collection itself, anexclusive design and mounting are provided in every service system. Forthis reason, although only the basic function of collecting the log isdesired, subtle differences are generated on log collection items. As aresult, an exclusive design and mounting is required for every serviceas for the basic collecting system.

SUMMARY OF THE INVENTION

[0006] It is an object of the present invention to provide a logcollecting/analyzing system, a method for log collection, a logcollection program, a method for log analysis, a log analysis program, alog collecting device, a log analyzing device, a log collection terminaldevice and a log server, all of which are capable of performing flexiblelog collection and analysis without being a fixed log system as before.

[0007] A log collecting/analyzing system of the present invention has aconfiguration in which a client terminal device collects log informationand transmits collected log information to a log server via a network,and then the log server stores the received log information to analyze.In addition, the client terminal device is provided with a function forforming the basic structure of a log, a function for generating desiredlog information from the basic structure of the log and a function fortransmitting the generated log information to the log server.

[0008] Namely, in the present invention, the log collection function isseparated into a basic collection function and a specificcollection/analysis function, so that the basic log collection functionis capable of being used as a common log collection function. Accordingto this configuration, the log collecting/analyzing system using the logcollection function does not need to conduct mounting of its basicfunction. In addition, it becomes possible to design and mount specificcollection/analysis functions more easily by using this basic collectionfunction, and, as a result, it becomes possible to collect effectivelogs. In addition, in the present invention, it is possible to establisha common log form as well as a common analysis function.

[0009] In addition, log collection had an aspect in which utilization atan on-line system was taken to be an assumption, because utilization atthe server side of service system was the main utilization until now.However, in the present invention, the log collection analysis functionof the log system is separated into a function of log collection for theclient side and a function of log analysis for the server side, and thenthe client side conducts collection of the log and the server sideconducts analysis of the log. According to this configuration, theclient side is capable of collecting the log in an off-line condition.

BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other features will be better understood from theexemplary embodiments described below, taken together with the drawings,in which:

[0011]FIG. 1 is a block diagram illustrating the configuration of anentire log collecting/analyzing system;

[0012]FIG. 2 is a block diagram illustrating a configuration example ofa log collection terminal device;

[0013]FIG. 3 is a flowchart illustrating the flow of log systemprocessing at the log collection terminal device;

[0014]FIG. 4 is a flowchart illustrating the flow of initialization of alog system;

[0015]FIG. 5 is a view illustrating one example of log user information;

[0016]FIG. 6 is a flowchart illustrating login processing;

[0017]FIG. 7 is a view illustrating a display example of a login screen;

[0018]FIG. 8 is a view illustrating the configuration of a log system atthe side of the log collection terminal device for log collection;

[0019]FIG. 9 is a view illustrating the configuration of a log object;

[0020]FIG. 10 is a view illustrating the internal structure ofmanagement information of a log;

[0021]FIG. 11 is a chart illustrating the tree structure of aconfiguration example of log data 1;

[0022]FIG. 12 is a view illustrating an example of log data representedusing XML (extensible Markup Language);

[0023]FIG. 13 is a view illustrating an example of a log objectrepresented using XML;

[0024]FIG. 14 is a view illustrating an example of an API (ApplicationProgramming Interface) for forming log data;

[0025]FIG. 15 is a view illustrating a method of storing a log object;

[0026]FIG. 16 is a block diagram illustrating a configuration example ofa log server;

[0027]FIG. 17 is a view illustrating the configuration of a log systemat the side of the log server;

[0028]FIG. 18 is a view illustrating the configuration of a managementdatabase of a log;

[0029]FIG. 19A illustrates the configuration of a management database ofa log: a view illustrating a management table of a log user;

[0030]FIG. 19B illustrates the configuration of a management database ofa log: a view illustrating a management table of utilization of a logapplication;

[0031]FIG. 19C illustrates the configuration of a management database ofa log: a view illustrating a management table of a log application;

[0032]FIG. 20 is a view illustrating the configuration of a log storagedatabase;

[0033]FIG. 21A illustrates the configuration of a log storage database:a view illustrating a log storage table for the user;

[0034]FIG. 21B illustrates the configuration of a log storage database:a view illustrating a log storage table for a log application;

[0035]FIG. 22 is a view illustrating the configuration of a managementdatabase of a log analyzed result;

[0036]FIG. 23 illustrates the configuration of a management database ofa log analyzed result: a view illustrating a management table of a loganalyzed result;

[0037]FIG. 24 is a view illustrating an example of a storage table of alog analyzed result;

[0038]FIG. 25 is a flowchart illustrating the flow of a log serversystem;

[0039]FIG. 26 is a flowchart illustrating the flow of log reception;

[0040]FIG. 27 is a flowchart illustrating the flow of log analysis;

[0041]FIG. 28 is a flowchart illustrating the flow of acquisition of alog analyzed result utilizing the company side of a log collectionservice;

[0042]FIG. 29 is a flowchart illustrating the flow of acquisition of alog analyzed result at the log server side; and

[0043]FIG. 30 is a view illustrating another configuration of log systemat a log collection terminal device.

DETAILED DESCRIPTION

[0044] Preferred embodiments of the invention are described in detailbelow, with reference being made to the accompanying drawings. Aspecific embodiment to which the present invention is applied will bedescribed in detail below, referring to the accompanying drawings.

[0045] The present embodiment provides an entirely new example of a logcollecting/analyzing system in which a client side collects loginformation and transmits the collected log information to a serverside, and the server side stores therein the transmitted log informationto analyze. Namely, the present invention separates the function of thelog collecting/analyzing system into two functions of collecting a logand storing/analyzing the collected log, in which the client sidecollects logs while the server side stores and analyzes the logs.

[0046] In addition, the function of the client side is to establish thebasic structure of the log and then generate desired log informationfrom the basic structure of the log. On the other hand, the function ofthe log server is to execute storage-analysis of the received loginformation and then analyze the log information in every applicationprogram.

[0047] The Configuration of the Entire Log Collecting/Analyzing System

[0048] In the first place, the rough flow of log collection, analysisand provision in the log collecting/analyzing system will be described.

[0049]FIG. 1 illustrates the configuration of the entire logcollecting/analyzing system. Log collection terminal devices 1 to 4,being client terminal devices provided with client side software andclient side hardware for collecting logs, are connected to network 5. Itshould be noted that any number of log collection terminal devices maybe added to the network 5.

[0050] In the log collecting/analyzing system illustrated in FIG. 1, thelog collection terminal devices 1 to 4 collect logs and store the logstherein temporarily. The log collection terminal devices 1 to 4 transmitlog information that is collected and stored therein to log server 7 viathe network 5. The log server 7 is provided with log storage area 6 forstoring the received log information. The log server 7 reads out thestored log information from the log storage area 6 and then executesanalysis processing of the log information before storing the analyzedresult in the log storage area 6 again.

[0051] It should be noted that respective procedures for analysisprocessing executed by the log server 7 are defined by log collectionservice utilizing companies 9 to 12. In addition, the design andmounting are established so that the collection program when conductinglog collection and analysis processing corresponds to the log collectionside and the log analysis side, respectively.

[0052] Here, consideration is made in connection with the case that thelog collection service utilizing companies 9 to 12 require an analyzedresult of the log. At this time, to begin with, the log collectionservice utilizing companies 9 to 12 input acquisition requirements ofthe analyzed result to the log server 7 via the network 8. The logserver 7 which has received the acquisition requirements from the logcollection service utilizing companies 9 to 12 authenticates the logcollection service utilizing companies 9 to 12 connected to the networkand then adopts or rejects companies 9 to 12 on the basis of theauthentication result. After that, the log server 7 transmits the loganalyzed result to the authenticated companies. It should be noted thata plurality of log collection service utilizing companies areconnectable to the log server 7 via the network 8. Then, the log server7 is capable of transmitting the log analyzed result to any of the logcollection service utilizing companies 9 to 12 that are authenticated tobe connected to the log server 7 via the network 8.

[0053] Log Collection Terminal Device (Client Side)

[0054] Configuration of Log Collection Terminal Device

[0055] The following describes the configuration of the log collectionterminal devices 1 to 4. FIG. 2 illustrates the internal configurationof one log collection terminal device. The log collection terminaldevice comprises image/sound control unit 13, CPU (central calculationprocessing unit) 14, communication control unit 15, media control unit16, RAM 17, external memory control unit 18, input control unit 19, andHDD (magnetic recording medium) 20 as principal configuration elements,in which these respective elements are connected with each other via abus.

[0056] The image/sound control unit 13 controls the image output to amonitor unit that is not illustrated and the voice output to a speakerand so forth, or the input from a video camera and a microphone. The CPU14 controls the total operation of the log collection terminal device.The communication control unit 15 that is connected to the network 5illustrated in FIG. 1 controls communications executed between thecommunication control unit 15 and the network 5. The media control unit16 controls a media drive which is not illustrated, in that the mediacontrol unit 16 inputs therein signals from external recording mediasuch as a CD-ROM and/or a DVD-ROM and so forth loaded in the mediadrive, or the media control unit 16 writes signals to the externalrecording media.

[0057] The HDD 20 records various kinds of programs for realizing thelog collection processing of the present embodiment and/or various kindsof data. The RAM 17 stores therein a program read out from the HDD 20and/or data utilized during execution of various kinds of processing.The external memory control unit 18 is connected to nonvolatile memory21 existing at an external part of the log collection terminal device.The external memory unit 18 controls the transmission/reception of thedata as well as the write/read of the data between the external memorycontrol unit 18 and the memory 21. The input control unit 19 controlsuser interface input units, such as a keyboard, mouse, and so forth thatare not illustrated.

[0058] Flow of Processing at the Time of Log System UtilizationAccording to the Log Collection Terminal Device

[0059] The flow of processing (principally, processing of an applicationpart according to the present invention) at the log collection terminaldevice will be explained using FIG. 3. It should be noted that theprocessing illustrated in FIG. 3 is mainly achieved by the function ofthe CPU mounted in the log collection terminal device. First, as theprocessing of STEP S1, the log collection terminal device initializesthe log collecting/analyzing system illustrated FIG. 1 in order topermit utilization of the log collecting/analyzing system. In thisinitialization, determinations are made in which the log collectionterminal device ascertains the log user in order to use the logcollecting/analyzing system, the log collection terminal devicedetermines whether it is capable of using the log collecting/analyzingsystem, and so forth. When the processing in the log collection terminaldevice is completed, initialization of the application is executed asthe processing of STEP S2.

[0060] When the initialization of the application is completed, the logcollection terminal device provides main processing (application mainprocessing) of the application as the processing of STEP S3. It shouldbe noted that the application main processing will be described later.Then, the log collection terminal device, when the application mainprocessing is completed, executes processing to terminate utilization ofthe log collecting/analyzing system as the processing of STEP S4.According to this termination processing, the log collection terminaldevice stores the log information maintained in the RAM 17 for the sakeof the log collecting/analyzing system in the HDD 20 and so forth.Further, the log collection terminal device releases resources that areused for the log collecting/analyzing system. After that, the logcollection terminal device conducts termination processing of theapplication of the present embodiment as the processing of STEP S5.After that, the log collection terminal devices 1 to 4 are in acondition in which they are capable of being terminated.

[0061] Initialization of the Log Collection Terminal Device for the Useof the Log Collecting/Analyzing System

[0062] The following describes details of the processing to enableutilization of the log collecting/analyzing system as conducted in STEPS1 of FIG. 3. FIG. 4 illustrates a flowchart for initializationprocessing of the log collection terminal device to enable utilizationof the log collecting/analyzing system. First, the log collectionterminal device conducts login processing of the log user as theprocessing of STEP S6. This login processing is necessary processing foridentifying the user who is using the log collecting/analyzing system,and the processing provides information concerning the user so that theuser is identified.

[0063] In the identification processing of STEP S6, when the user is notregistered as a log user, log user registration processing is conductedin the processing of STEP S7. In this registration processing, the logcollection analysis terminal device, to determine whether doubleregistration of the user is being conducted, compares informationregistered beforehand with information input by the log userregistration whether the user is an unfair user, and so forth. Then, inthe processing of STEP S8, when user registration has been successful,the log collection terminal device continues log system initialization.In the processing of STEP S8, if the user registration is not made forsome reason, the log collection terminal device interrupts the logsystem initialization and sets the log system in a use prohibitioncondition in the processing of STEP S12. Thereafter, the log collectionterminal device concludes the log system initialization.

[0064] On the other hand, in the processing of STEP S8, whenregistration as a log user is successful, the log collection terminaldevice inputs therein log user information stored in, for instance, theHDD 20 and/or the nonvolatile memory 21 as the processing of STEP S9.Further, the log collection terminal device inputs therein log systemutilization title information as the processing of STEP S10.

[0065] Then, the log collection terminal device determines whether thelog system can be utilized as the processing of STEP S11. It should benoted that this determination is conducted to control the period ofusing the log system. For instance, in cases where certain log serviceis established so as to provide service for only one month, if, forinstance, the service period of the log collecting/analyzing system hasbeen concluded, it is no longer possible to transmit the log to the logserver 7. Therefore, the log collection terminal device determineswhether the log collecting/analyzing system may be used in order toforestall the occurrence of such condition.

[0066] When it is determined in STEP S11 that the logcollecting/analyzing system cannot be utilized, the operation of the logcollection terminal device proceeds to processing of STEP S12, in whichthe log system is set in the use prohibition condition. This useprohibition condition is one in which the log collection terminal deviceoverrides the recording of the log in the log collecting/analyzingsystem, and the function of transmitting the log to the log server 7,and so forth. Thus, when the log collecting/analyzing system is set tothe use prohibition condition, an application that employs the logcollecting/analyzing system is capable of executing processing in thesame way as during normal functioning regardless of whether the logcollecting/analyzing system is effective or ineffective. However, thespecific processing to record logs and/or transmit logs is not executed.Namely, the log collection terminal device realizes control of the useprohibition condition in such a way as to internally control whether theprocessing to record logs and to transmit logs is affected.

[0067] On the other hand, when it is determined that the logcollecting/analyzing system is capable of being used at STEP S11, thelog collection terminal device executes transmission processing of logsthat have not yet been transmitted as the processing of STEP S13.

[0068] The present invention is characterized in that it is possible torealize the function of collecting logs in an off-line environment. Theprocessing of STEP S13 relates to the function of collecting logs in anoff-line environment. Namely, when the log collection terminal device isalways connected to the network 5, it is possible to process surely thetransmission of a log to the log server 7, while when the network 5 isinterrupted, or when it is not possible to transmit log information tothe log server 7 because of some kind of obstacle, the log collectionterminal device stores the log information temporarily, and thentransmits the log again when the network 5 or the log server 7 isrestored to a normal condition. The processing of STEP S13 is one inwhich the retransmission function is realized.

[0069] Record of Log User Information

[0070] Next, information registered as log user information and theregistered position thereof are explained.

[0071] If the log user information is recorded in nonvolatile recordingmedia on the log collection terminal device, any recording position ispermitted. For instance, it is possible to record the log userinformation in the nonvolatile memory 21 or the HDD 20 illustrated inFIG. 2, or on writable media controlled by the media control unit 16.However, when convenience and/or confidentiality are taken intoconsideration, recording in the nonvolatile memory 21 is desirablebecause information recorded in a nonvolatile memory may be easilyutilized for login processing at another log collection terminal device.It is assumed in the present embodiment that the log user information isrecorded in the nonvolatile memory 21. In the present embodiment, eachuser is assigned a nonvolatile memory 21 and each user uses thenonvolatile memory 21, whereby the log collection terminal device iscapable of identifying respective log users.

[0072]FIG. 5 illustrates one example of log user information 22. The loguser information includes, for instance, name 23, address 24, telephonenumber 25, age 26, log user ID 27, and password 28. The password 28 isone that is established at the time of log user registration. Input ofthe password 28 is desired when the log user performs login so that itis possible to identify the user as the identical person when thepassword 28 is correct. It is assumed in the present embodiment that thenonvolatile memory 21 in which the log user information is recorded isused as an authentication card. Hereinafter, the nonvolatile memory 21is referred to as authentication card 21.

[0073] Login Processing

[0074] The login processing of STEP S6 illustrated in FIG. 4 will now beexplained. A flowchart of this login processing is illustrated in FIG.6. First, as the processing of STEP S14, the log collection terminaldevice allows a monitor unit (not illustrated) to display a login screen29, as illustrated in FIG. 7 for example. The log collection terminaldevice causes the login screen 29 to display user ID display line 30 andpassword input line 31. The user ID display line 30 displays the ID thatis recorded in the authentication card 21 (nonvolatile memory 21). Thepassword input line 31 is where the log user inputs the password 28.

[0075] In addition, the log collection terminal device determineswhether the log user has the authentication card 21 at the time of theprocessing of STEP S14. Namely, the log collection terminal devicedetermines whether the log user has the authentication card 21 bydetecting whether the authentication card 21 is connected to theexternal memory control unit 18, and whether the log user information isrecorded within the authentication card 21.

[0076] In STEP S15, when the log collection terminal device determinesthat the log user does not have the authentication card 21, the logcollection terminal device regards the log user as a new one, and thenmoves the processing to the new registration processing of STEP S16. Onthe other hand, when the log collection terminal device determines thatthe log user has the authentication card 21 at STEP S15, the logcollection terminal device determines that the log user already has beenregistered as a log user, and then the log collection terminal devicemoves the processing to the processing of STEP S17. When proceeding tothe processing of STEP S17, the log collection terminal device inputstherein the log user ID 27 from the authentication card 21 and thencauses the log user ID 27 to be displayed on the user ID display line30.

[0077] Next, the log collection terminal device, in STEP S18, takes inthe password 28 input by the log user. The log collection terminaldevice then verifies the password 28 in STEP S19. It should be notedthat the password 28 is input via an input unit, such as a keyboard andso forth. When the result of verifying the password 28 in STEP S19 isthat the password input by the log user does not agree with theregistered password, the log collection terminal device causes theprocessing to move to the processing of STEP S20 in which login failureprocessing is conducted. In this login failure processing, it ispossible to request input of the password 28 again or it is possible tosimply terminate processing as a login failure. It should be noted thatit is assumed in the present embodiment that the login is terminated asa result of the login failure processing of STEP S20.

[0078] When the result of verifying the password 28 in STEP S19 is thatthe password input by the log user agrees with the registered password,the log collection terminal device determines that user authenticationis completed, and then executes login success processing as theprocessing of STEP S21. After that, the log collection terminal deviceterminates the login processing. It should be noted that in the loginsuccess processing in STEP S21, for instance, a screen indicatingsuccess in login and so forth may be displayed.

[0079] System Configuration of a Log Collection Terminal Device

[0080]FIG. 8 illustrates the connection of programs for realizing logcollection and log transmission in the log collection terminal device.In the present embodiment, there is provided a login interface having afunction for forming the basic structure of the log and a function forgenerating desired log information from the basic structure of the logwhich the login interface constructs hierarchically. The hierarchicallyconstructed log information is then transmitted to the log server 7.Alternatively, the log information may be independently managed in everyapplication program.

[0081] The program illustrated in FIG. 8 comprises an application 32 forutilizing the log system, a log system basic function processing unit 33for providing the basic functions of the log collecting/analyzing systemand an operating system 39 for operating the log collecting/analyzingsystem, in which the upper side and lower side relationship illustratedin FIG. 8 means that the function positioned at an upper order utilizesthe function of a lower order.

[0082] The log system basic function processing unit 33 is separatedinto several processing units. Login interface management unit 34manages a login interface 38. The login interface 38, which isindependently defined by the log collection service utilizing companies9 to 12 for utilizing collected log information, executes processing foroutputting a log that is specialized in accordance with the respectivelog service. When the application 32 requires the login interface 38,the login interface management unit 34 is initialized to provide thedesired login interface 38.

[0083] Log object processing unit 35 is a unit for controlling thefunction of the log object as being basics of the log. Log objecttransmission unit 36 is a unit for controlling the processing totransmit log information to the log server 7. Log object management unit37 is a unit for managing the log itself, such as a storage area of thelog object, elimination processing thereof and so forth. For instance,when executing storage of logs, the log object management unit 37specifies an appropriate position for the storage. Also, on the occasionof eliminating an unnecessary log, the log object management unit 37controls the elimination.

[0084] Configuration of a Log Object

[0085]FIG. 9 illustrates the configuration of log object 40. Log object40 is composed of log management information 41 and log data 1 to 4 (42to 45). The log management information 41 is where information on thebackground of the log object 40 is recorded. The log data 1 to 4 (42 to45) are where specific log information generated by the login interface38 is recorded. The log object 40 may include a larger amount of logdata. It should be noted that FIG. 9 illustrates one example thereof.

[0086]FIG. 10 illustrates the internal configuration of the logmanagement information 41. The log management information 41 is composedof log application ID 46 and log user ID 47. The log application ID 46is identification information that is utilized to control the use of thelog collecting/analyzing system. In addition, the log user ID 47indicates identification information utilized to indicate which user thelog belongs to.

[0087] Next, the configuration of the log data 1 to 4 (42 to 45) isexplained using the example of FIG. 11. FIG. 11 illustrates theconfiguration of the log data 1 (42) which is divided into nodes andelements having a tree structure. The node is capable of including nodesor elements. It should be noted that the node cannot be utilized as aterminal device. On the other hand, the element is capable of beingutilized as a terminal device and capable of including arbitrary data.The node 48 is a root node, and the front of the log data refers to thefront node of the root node 48. The node 49 includes element 50 at alower position.

[0088] The log data 1 to 4 (42 to 45) are capable of adopting anarbitrary log structure as a result of managing the tree structure.Here, in the present embodiment, XML (extensible Markup Language) isutilized as the specification for defining this tree structure. FIG. 12illustrates one example thereof. This FIG. 12 illustrates an example inwhich is recorded a selected play mode and the number of utilization ofthe play mode in a certain application such as a video game and soforth. The tag <playDate> in FIG. 12 indicates data as to when the usertakes the log, and the tag <mode>records the play mode name that is usedin this case (indicated by the tag <name>) and the number of usesthereof (indicated by the tag <selectedTimes>). This example indicatesthat the record is one in which PracticeMode is used three times at2000, 12,

[0089] When extracting data from this log data, it is possible toretrieve desired data by following the tag. Here, FIG. 13 illustrates anexample of the case in which the log object illustrated in FIG. 9 isexpressed as XML. In the example of FIG. 13, <info> tag 51 describesboth the log application ID (hereinafter referred to as log appli. ID46) for indicating the log application program (hereinafter referred toas the log appli.) that generates the log object and the log user ID 47indicating the user to become the object of the log.

[0090] In addition, the log related to the login interface is describedin<DATA>tag 52. That is, the <DATA> tag 52 illustrated in FIG. 13describes that this tag is one which is generated by the login interfaceindicated by interface ID1. Further, the inside of the <DATA> tag 52describes the log itself constituted by the login interface indicated bythe interface ID1. The shape of the <DATA> tag 52 at this time is likethe one illustrated in FIG. 11. Accordingly, if these tags are followed,it is possible to retrieve desired data. It should be noted that theseIDs are utilized in order to homologize the analysis interface used onthe occasion that the analysis of the log is executed onto the log atthe log server 7 later.

[0091] Relationship Between Login Interface and Service

[0092] The tree structure of the log illustrated in FIG. 11 is alsocapable of being output directly from respective applications. However,when preparing such configuration in every application, there may beproblems that programs for forming the tree structure are redundant. Inaddition, since pre-arrangements for recording the log are large,development efficiency decreases. Since the development of programs forforming the tree structure in every respective application causes badefficiency, the present embodiment enhances development efficiency ofthe application by providing programs for forming the tree structure asa library.

[0093] In order to solve the above object, the present inventionseparates functions such as preparation, storage and so forth of basicstructures of the log as basic functions, further designing and mountingspecific recorded parts of the log at the application side that utilizesits basic function as a login interface, whereby the present inventionrealizes an effective log collecting/analyzing system capable offlexibly coping with various kinds of uses.

[0094] That is, in the present embodiment, the login interface 38illustrated in FIG. 8 provides the above-described log data 1 to 4. Thelogin interface 38 described in the present embodiment is a program thatis designed and mounted in order to collect and record logs, in whichthe login interface 38 functions as an API (Application ProgrammingInterface) between the application 32 illustrated in FIG. 8 and the logsystem basic function processing unit 33. This library with the logininterface 38 mounted allows a log basic library for preparing a basictree structure on the inside thereof to access, in which the log basiclibrary outputs the result and receives in accordance with a determinedformat. In addition, the log basic library hierarchically constructs thelog and then designs and loads a specialized log for the applicationprogram.

[0095] Here, the login interface 38 is specifically designed dependingon the necessary log contents, and one example thereof is illustrated inFIG. 14. In the login interface 38 illustrated in FIG. 14, API 53 is onein which the date of use is recorded. At the side of the application 32,it is possible to generate the <PlayDate> tag by accessing this API 53.In addition, it is possible for the application 32 to prepare the <mode>tag and the following structure bodies by accessing the API 53. Itshould be noted that, as for the API 54, device is slightly added inthis mounting in that, when a mode with the same name is used, 1 isadded to the record of the number of times of use. Thus, according tothe mounting of the login interface 38 of the present embodiment, theside of the application 32 can manage data desired to be recorded, andalso the side of the login interface 38 is capable of managing the datadesired to be recorded. Thus, any of them is capable of recordingnecessary data.

[0096] Next, the storage method of the above-described log objectincluding logs will be described using FIG. 15. Log objects are recordedin a nonvolatile storage area such as HDD20, a flash memory and soforth. In the present embodiment, log objects are recorded inauthentication card 21. In addition, the log object is managed in everyapplication unit in which the log object is used. Namely, the log objectis managed in its storage area in every application with the shape oftitle 1, title 2, . . . illustrated in FIG. 15, in which the logs areregistered to those respective areas. For instance, log storage area 55illustrated in FIG. 15 is managed for the sake of application of title1, and log 56 is registered to the area 55 in that the applicationutilizes the log 56.

[0097] The log object is stored with a structure as illustrated on theright side of FIG. 15. Namely, the log object consists of a transmissionflag 57, a log object size 58 and a log object 59. The transmission flag57 records conditions when transmitting logs to the log server 7. Thus,the transmission flag 57 has three conditions of, for instance,un-transmitted, finished transmission and in transmission. Theun-transmitted condition means that the log has not yet been transmittedto the log server. The finished transmission condition means that thelog has already been transmitted to the log server 7. The intransmission condition means that transmission of the log to the logserver 7 has not been completed as a result of some interruption of thetransmission in the last time transmission of the log. When transmittingthe logs, the un-transmitted log or the in transmission log istransmitted to the log server 7. In addition, the log storage area 55increases to accumulate the logs. However, it is possible to remove thelogs which have finished transmission. For this reason, memory areassuch as HDD 20, flash memory and so forth are not pressured.

[0098] Termination Processing of the Log System

[0099] Next, termination processing at the side of the log collectionterminal device will be explained. In the side of the log collectionterminal device, when an application is made to terminate, first, it isnecessary to terminate utilization of the log collecting/analyzingsystem. This processing is necessary in order to record the log withoutcontradiction. For this reason, the log collection terminal deviceallows utilization termination processing of the logcollecting/analyzing system to execute (the processing of STEP S4illustrated in FIG. 3) before the termination processing of theapplication (the processing of STEP S5 in FIG. 3). Specifically, the logcollection terminal device forcibly stores therein the log object inuse, and/or executes use termination processing of the log storage area,and so forth in safety. The log collection terminal device subsequentlyexecutes termination processing of the log application itself at STEPS5, and thus terminates operation of the log collection terminal deviceitself.

[0100] Log Server (Server Side)

[0101] Configuration of the Log Server

[0102] The configuration of the log server 7 side will now be explained.The log server 7, as illustrated in FIG. 16, is composed of image/soundcontrol unit 60, CPU 61, communication control unit 62, media controlunit 63, RAM 64, input control unit 65 and HDD 66 as the principalconfiguration elements. These elements are all connected to one anothervia bus 67.

[0103] The image/sound control unit 60 controls image output for amonitor unit that is not illustrated and voice output for a speaker andso forth, or controls inputs from a video camera and a microphone. TheCPU 61 controls programs on the log server 7 and/or controls equipmentconnected via bus 67. The communication control unit 62 is connected tothe networks 5, 8 illustrated in FIG. 1 and controls communicationexecuted between the networks 5 and 8 and another part, receives thelogs and so forth. The media control unit 63 controls a media drive thatis not illustrated, and inputs the signals from external media such as aCD-ROM, DVD and so forth loaded in the media drive. In addition, themedia control unit 63 allows signal writing and so forth to externalmedia, such as a CD-RW and so forth. The RAM 64 is a unit for storingprograms, data and so forth for operating at the log server 7. The inputcontrol unit 65 controls user interface input units at the log server 7,such as a keyboard or mouse that are not illustrated. The HDD 66 is alarge capacity storage area for recording log information managed at thelog server 7 and/or for recording an analyzed result and so forth.

[0104] System Configuration of the Log Server

[0105] Next, FIG. 17 illustrates in outline form the configuration of aprogram for performing reception-analysis of logs in the log server 7.In the present embodiment, the log server independently manages loginformation received from the log collection terminal device for eachindividual application program, and pulls out necessary information fromthe log information to analyze. After that, the log server stores theanalyzed result in a desired form.

[0106] The program illustrated in FIG. 17 is mainly provided with anoperating system 74, a log server function processing unit 68 and a loganalysis interface 70, and the relationship between upper and lower inthe drawing means that an upper rank section utilizes the function of alower rank section. The log server function processing unit 68 iscomposed of a log analysis interface management unit 69, a log objectanalysis unit 71, a log object reception unit 72 and a log analyzedresult management unit 73.

[0107] The log analysis interface management unit 69 manages the loganalysis interface 70. That is, the log server 7 is capable of pullingout the log analysis interface 70 necessary for analysis in such a wayas to go through the log analysis interface management unit 69. The loganalysis interface 70 is an interface for analyzing log informationreceived from the log collection terminal device. Such log analysisinterface 70 is designed and mounted with a form corresponding to thelogin interface 38 used at the log collection terminal device side.

[0108] The log object analysis unit 71 analyzes logs received by the logserver 7. The log object reception unit 72 controls the function ofreceiving logs transmitted from the log collection terminal device. Thelog analyzed result management unit 73 stores therein the results of theanalysis performed in the log object analysis unit 71. In addition, thelog analyzed result management unit 73 provides the result of analysisto the log collection service utilizing companies 9 to 12.

[0109] Log Management Database

[0110] The above-described log server 7 receives the above-described logand allows databases to be prepared in order to store and manage theresults of the analysis performed by the log server 7. In the presentembodiment, a log management database, a log storage database and a loganalyzed result management database are prepared. FIG. 18 to FIG. 23illustrate configurations of these databases. It should be noted thatthese databases are managed in the log storage area 6 illustrated inFIG. 1.

[0111]FIG. 18 illustrates in outline form the configuration of the logmanagement database. The log management database is composed of a loguser management table 76, a utilization log application management table77 and a log application management table 78.

[0112] The log user management table 76 manages information of userssubjected to log service. The contents of this table include the loguser ID, name, age, address, telephone number, log storage table nameand utilization log application management table name, as illustrated inthe log user management table 76 of FIG. 19A. Since such name, age,address, telephone number and so forth are one example of the tablecontents, when detailed information including personal information isdesired, it is possible to handle such situations by increasing theitems in the table, if necessary. Log user information in the log usermanagement table 76 is prepared by a new log user registration. Forinstance, the new log user registration processing in STEP S16illustrated in FIG. 6 provides the log user information.

[0113] The log storage table name is where the log is specified as beingstored when the log server 7 receives the log. The log is stored andmanaged for every log user. The log management information of the logobject illustrated in FIG. 10 is utilized here. The log appli. IDdescribed in the log object is used to classify the log application. Inaddition, the log user ID is used in order to classify the log users.

[0114] The utilization log application management table name specifiesthe utilization log application management table 77 in order to managethe log application being used by the user. The utilization logapplication management table 77 is composed of the log appli. ID and thefinal log reception date and time, as illustrated in FIG. 19B. Theutilization log application management table 77 is prepared for everylog user, and the utilization log application management table 77manages information regarding which log application has been used by thelog user. Accordingly, it is possible to immediately know which logapplication has been used by a log user by referring to this table.

[0115] The log application management table 78 manages the logapplications executing the log service. The configuration of the logapplication management table 78 is illustrated in FIG. 19C. The logapplication management table 78 is composed of log appli. ID, licenseename, authentication data, log storage table name, the number ofanalysis table, the log analyzed result management table name and anin-service flag. The log appli. ID is a number unique to eachapplication that uses the log collecting/analyzing system. The licenseename indicates the person who prepares the log application or thecompany name thereof. The authentication data is utilized in order toascertain other persons who, on occasion, provide the log. The logstorage table name indicates the log storage table for the logapplication in order to manage the log registered in the logapplication. The number of analysis table indicates the number ofanalyzed result tables existing in the result of analyzing by the logapplication. The log analyzed result management table name manages thetable that stores the log analyzed results, and is generated for eachlog application. The in-service flag controls whether the logapplication is capable of being utilized. The flag is utilized toindicate service conditions, such as, for instance, that service isalready terminated.

[0116] Log Storage Database

[0117]FIG. 20 illustrates in outline form the configuration of the logstorage database 79. The log storage database 79, as illustrated in FIG.20, is composed of a log storage table for the user 80 and a log storagetable for the log application 81. The log storage table for the user 80,when the log user transmits a log to the log server 7, is a position inwhich the log is stored first. The configuration of the log storagetable for the user 80, as illustrated in FIG. 21A, includes a logreception ID, a log reception date and time, a utilization logapplication ID and logs. The log reception ID is a unique number forevery log reception. The log reception date and time is the date andtime when the received log is recorded. The utilization log applicationID indicates what log application was utilized for a recorded log.Further, the log object itself is recorded in the log shown in FIG. 21A.In the analysis of the log, it is possible to specify which log in thelog storage table is to be analyzed by user 80 according to the logreception ID and the log user ID.

[0118] The log storage table for log application 81 manages the logsregistered in the log application. The log storage table for logapplication 81 is utilized for analysis of the log. Analysis of the logis executed for every log application. However, the determination ofwhether a log has been analyzed is made while referring to this logstorage table for log application 81. The log storage table for logapplication 81 is composed of a log reception ID, a log reception dateand time, and a log user ID, as illustrated in FIG. 21B.

[0119] Log Analyzed Result Management Database

[0120]FIG. 22 illustrates in outline form the configuration of the loganalyzed result management database. The log analyzed result managementdatabase 82 is composed of a log analyzed result management table 83 andan analyzed result storage table for each login interface 84. The loganalyzed result management table 83, as illustrated in FIG. 23, iscomposed of a log analysis interface ID and a log analyzed resultstorage table name. The log analysis interface ID indicates theinterface for analyzing the log and corresponds to the ID of the logininterface 38 used on the side of the log collection terminal device. Thelog analysis interface ID is one to which the function for accessingnecessary information is mounted, in which necessary information isaccessed to be pulled up from the log that is generated by the logininterface at the side of the log collection terminal devices 1 to 4.

[0121] Here, specifically, the operation of the log analysis interfacewill be explained by using the example of the log data illustrated inFIG. 12 and the example of the login interface illustrated in FIG. 14.The example describes the case of analysis of the log to determine “Datewhen play is performed”, “which mode is selected”, and “the mode isselected how many times”. The log analysis interface extracts the first“date of performing play” and “the number of selection of mode” from thelog object and then stores the analyzed result in the table illustratedin FIG. 24. This table is composed of the log user ID, date of play andfour play modes (practice mode, tournament mode, season mode, customizemode). In play date, the play date illustrated in FIG. 12 is described.In addition, for the four respective play modes, the number of playingtimes is described. Further, in the log user ID, the log user ID of theuser transmitting the log is described. The log analysis interface 70executes extraction of data, conversion and record processing in orderto record such analyzed result in the database.

[0122] Flow of Processing for the Log Server System

[0123] The entire flow in the log server system will be described nextwith reference to FIG. 25. It should be noted that the processingillustrated in FIG. 25 is mainly conducted by CPU 61 of the log server7. Firstly, as the processing of STEP S22, the log server system isinitialized. In this initialization, the database manager is initializedin order for the log server system to use the database. Also initializedare computer resources for the log server 7 that require the aboveinitialization of the database manager. Next, in the processing of STEPS23, the log server system is put in a log reception condition toreceive signals (log information) transmitted from the log collectionterminal device. Here, a stand-by condition continues until the logreception is completed.

[0124] When the log server receives the logs, the log server 7 executesanalysis processing of the received logs in the processing of STEP S24.The analysis processing of the logs in STEP S24 executes respectiveappropriate analyses according to log analysis interface 70 thatspecifies the contents of the logs. Further, when terminating analysisof the logs, the log server system executes a termination check in theprocessing of STEP S25. Generally, since the log server system continuesoperation, the log server system returns to the processing of STEP S23to come into the log reception condition. However, when the log serversystem determines that a termination order has been issued, processingproceeds to STEP S26 to execute termination processing of the log serversystem. Termination of the log server system indicates termination ofthe computer resources and the database manager that the log serversystem uses.

[0125] It should be noted that the flow of processing of the log serversystem illustrated in FIG. 25 is simply an example. Therefore, the flowof processing illustrated does not limit the processing of the logserver system.

[0126] Flow of Log Reception

[0127] The flow in which the log server receives the log will now beexplained using the flowchart of FIG. 26. Firstly, in the processing ofSTEP S27, a determination is made as to whether the log server hasreceived logs. When the log server 7 has not received logs, theprocessing returns to STEP S27 itself, which processing is repeateduntil a log is received. When a log is received, processing proceeds tothe processing of STEP S28 in which the <info> tag included in the logis read out. The <info> tag describes the log user ID and log appli. ID.Next, in the processing of STEP S29, the received log is stored in thelog storage area 6 illustrated in FIG. 1.

[0128] The log storage area 6 is capable of being specified by the loguser ID as well as the log appli. ID. The log user management table 76of the log management database 75 is read out first. Then, the logstorage table for user 80 is identified by using the log user ID. Thereceived log is stored in the log storage table for user 80, and, atthis time, a log reception ID is obtained. The log reception ID is anumber for uniquely determining the log. In addition, the utilizationlog application management table 77 records the date and time the log isreceived and the log appli. ID in such a way as to match the former withthe latter.

[0129] Next, the log application management table 78 of log managementdatabase 75 is read out. Then, the log storage table for the logapplication is identified by using the log appli. ID. The log receptionID, log reception date and time and log user ID are recorded in thetable. The log reception ID is the log reception ID that is obtainedwhen storing the log in the log storage table for user 80. In addition,the log reception date and time is the same reception date and time thatwas provided for the user. The reception processing is completed afterthe above-described processing.

[0130] Flow of Log Analysis Processing

[0131] Next, the flow of log analysis processing will be explained usingthe flowchart illustrated in FIG. 27. Firstly, when the log server 7receives logs, analysis is started when the log is moved to the logstorage area 6. Thus, in the processing of STEP S30, a log list ofregistered logs is pulled up on the basis of the log appli. ID. That is,a log list registered according to the log appli. ID is pulled up fromthe log storage table for log application 81 of the log storage database79 illustrated in FIG. 20. The log list is prepared on the basis of thelog appli. ID because the analysis in every analysis unit is executed inevery log application unit. Next, in the processing of STEP S31, the logserver 7 determines whether the log list is empty.

[0132] When the log list is empty in STEP S31, since it is not possibleto execute a log analysis of the log application, the log analysis ends,and the processing proceeds to STEP S36, in which termination processingof log analysis is executed. When the log list includes logs, theprocessing proceeds to STEP S32 in which a log is pulled out from thelog list and a login interface ID is pulled out from the <DATA> tag.Next, in the processing of STEP S33, the log analysis interface 70 isgenerated from the login interface ID. In this processing, the logininterface management unit 69 illustrated in FIG. 17 is asked to generatethe log analysis interface 70 with the result that it is possible togenerate the log analysis interface 70. Next, in the processing of STEPS34, the log contained in the <DATA> tag is analyzed using the loganalysis interface 70 generated in STEP S33. As a result, necessaryitems of data are extracted, and then, in the processing of STEP S35,the result illustrated in FIG. 24 is stored. Subsequently, theprocessing from STEP S31 to STEP S35 is repeated until the log list isempty.

[0133] Method for Providing Log Analyzed Result

[0134] Next, a method for providing the log analyzed result analyzed bythe log server 7 to the log collection service utilizing company thatutilizes the log analyzed result will be explained using the flowchartillustrated in FIG. 28. FIG. 28 illustrates the flow in the case thatlog collection service utilizing companies 9 to 12, as log utilizationterminal devices, require the log analyzed result acquired by the logserver 7. Firstly, in the processing of STEP S37, the log collectionservice utilizing companies 9 to 12 execute login processing for the logserver 7. Namely, each log collection service utilizing companytransmits the name of the log collection utilization to the log server7, i.e., transmits the licensee name and authentication data to the logserver 7 via the internet 8 illustrated in FIG. l. The log server 7 usesthis information to authenticate the log collection service utilizingcompanies. Then, the processing of STEP S38 determines theauthentication result. When the authentication data is determined to beeffective data, the processing proceeds to STEP S39. On the other hand,when the authentication data is not effective, the fact that loginprocessing has failed is input to the log server 7 and the log analyzedresult acquisition processing is terminated.

[0135] In STEP S38, when the log collection service utilizing companysucceeds in login, the log collection service utilizing company enters astate in which log analyzed result acquisition is feasible. In STEP S39,the log collection service utilizing company specifies the log analyzedresult it desires to obtain. Namely, the log collection serviceutilizing company specifies and then transmits the login interface ID.As a result, the analyzed result is retrieved from the log server 7, andthen the processing of STEP S40 transmits the retrieval result to thelog collection service utilizing company. Then, the processing of STEPS41 determines whether the log analyzed result acquisition processing isto be terminated. When additional log analyzed results are needed, theprocessing returns to the processing of STEP S39, at which point theprocessing of STEP S39 to STEP S41 are repeated. Here, when it isdetermined that no additional log analyzed results are needed, the loganalyzed result acquisition processing is terminated.

[0136] As described above, the log collection service utilizing companyis capable of acquiring desired log analyzed results. However, the logininterface ID which may be specified is limited to the login interface 38established by the log collection service utilizing company. Whenanother login interface 38 is specified, no analyzed results arereturned.

[0137] Next, the processing at the side of the log server 7 in this loganalyzed result acquisition processing will be explained with referenceto the flowchart illustrated in FIG. 29. Firstly, in STEP S42, the logserver 7 processes the login requirements from the log collectionservice utilizing companies 9 to 12. Namely, the log server 7 acquiresthe licensee name and authentication data. Next, in the processing ofSTEP S43, the log server 7 retrieves the authentication datacorresponding to the licensee name from the log application managementtable 78 illustrated in FIG. 18. Then, in the processing of STEP S44,the log server 7 determines whether the login is effective or noteffective on the basis of the authentication data stored therein and theauthentication data from the log collection service utilizing company.

[0138] When it is determined that the authentication data is correct,processing to provide the log analyzed result is started. Namely, in theprocessing of STEP S46, log server 7 acquires the corresponding loganalyzed result management table 83 to receive the licensee name fromthe log application management table 78 illustrated in FIG. 19C. Then,in the processing of STEP S47, the log server 7 receives the logininterface ID transmitted from the log collection service utilizingcompany. Next, in the processing of STEP S48, the log server 7 reads outthe analyzed result from both the received login interface ID and thelog analyzed result management table. Then, the log server 7 transmitsthe read out result to the log collection service utilizing company inthe processing of STEP S49.

[0139] In the processing of STEP S50, the log server 7 determineswhether the processing to read out analyzed results has been terminatedby the log collection service utilizing company. If the log server 7determines that the processing to read out analyzed results has not beenterminated in this STEP S50, the processing returns to STEP S47, and theprocessing to read out log analyzed results is repeated. When theprocessing is to be terminated, the log server 7 executes processing toterminate log analyzed result acquisition. In addition, in theprocessing of STEP S44, when the log server 7 determines that the loginis not effective, the log server 7 informs the log collection serviceutilizing company that the login has resulted in failure at STEP S45,and then the log analyzed result acquisition processing at the side ofthe log server 7 is terminated.

[0140] As described above, in the present embodiment of the logcollecting/analyzing system, log collection terminal devices 1 to 4collect logs to generate desired log information, and then the loginformation is transmitted to the log server 7. The log server 7analyzes the received log information, and then the log collectionservice utilizing companies 9 to 12 receive the analyzed result.

[0141] It should be noted that, as illustrated in FIG. 8, the logininterface 38 is designed and mounted within application 32 whichutilizes basic functions. However, preferably, the login interface 38 isdesigned separately from the application 32 and is mounted independentlyfrom the application 32. Specifically, as illustrated in FIG. 30, thelogin interface management unit 34 of the log system basic functionprocessing unit 33 manages a login interface 38 prepared independentlyfrom the above-described application 32. The application 32 calls thelogin interface 38, and then the login interface 38 generates the loginformation.

[0142] In addition, in the log collection service utilizing company, itis preferable that the hardware for acquiring the log analyzed resultpossesses the same function as that of the log collection terminaldevices 1 to 4 as illustrated in FIG. 2, or it is preferable that thehardware for acquiring the log analyzed result possesses theconfiguration of a server of the type illustrated in FIG. 16. Then, asfor displaying the acquired analyzed result, there is no particularlimitation. The log analyzed result is defined beforehand with aspecified form in accordance with the log collection service utilizingcompany.

[0143] According to the present invention, the function of the logcollecting/analyzing system is divided into two functions in which onefunction is collecting log information, and the other function isanalyzing the collected log information. Further, the function ofcollecting log information belongs to the client terminal device, whilethe function of analyzing the collected log information belongs to thelog server. As a result, it is possible to specifically define the logcollection function. Thus, it is possible to collect a more detailedlog. For instance, in the case of games and so forth, what play modesare popular, or in the case of selecting a character for a game, whatcharacters are popular, are useful information for designing the game.The useful information can be obtained by the present invention. Forthat reason, it is possible to make use of the results of log analysisto develop the game while performing feedback of the results of loganalysis.

[0144] In addition, according to the present invention, log userinformation can be managed more accurately and then connected with thelog analyzed result, whereby it is possible to obtain a compoundanalyzed result, such as that the game is popular with which age groupand/or the game is popular with which sex. It is possible to record thebehavior of the user at the application on the basis of such analyzedresult. Namely, it is possible to dynamically change the function thatpermits development of the game according to the analyzed result. Inaddition, when the behavior of the user indicates that the user ispuzzled as to how to use the application, it is possible to supply amore effective hint to the game user from collected logs.

[0145] In addition, according to the present invention, since it ispossible to independently define the login interface for the sake of logcollection, mounting of a login interface capable of reuse is possibleaccording to the form of the log. For instance, the log may be one inwhich the user's taste is collected, and so forth. By this effect, thelogin interface for certain applications may be replaced with the samelogin interface. Accordingly, the same login interface may be utilizedat the application. Thus, it is possible to improve the developmentefficiency for the sake of log collection.

[0146] Although the invention herein has been described with referenceto particular embodiments, it is to be understood that these embodimentsare merely illustrative of the principles and applications of thepresent invention. It is therefore to be understood that numerousmodifications may be made to the illustrative embodiments and that otherarrangements may be devised without departing from the spirit and scopeof the present invention as defined by the appended claims.

1. A log collecting/analyzing system, comprising: a client terminaldevice having a collecting unit operable to collect log information anda transmitter operable to transmit collected log information via anetwork; and a log server having a storing/analyzing unit operable tostore and analyze the log information transmitted from the clientterminal device.
 2. A log collecting/analyzing system according to claim1, wherein the client terminal device further comprises a forming unitoperable to form a basic structure of a log and a generating unitoperable to generate desired log information from the basic structure ofthe log.
 3. A log collecting/analyzing system according to claim 2,wherein the forming unit is operable to form a tree structure consistingof nodes and elements as the basic structure of the log, and thegenerating unit is operable to generate the desired log informationhierarchically utilizing the tree structure.
 4. A logcollecting/analyzing system according to claim 1, wherein the clientterminal device manages the collected log information independently foreach application program.
 5. A log collecting/analyzing system accordingto claim 1, wherein the client terminal device stores the collected loginformation under an off-line condition except for log informationtransmission processing for the log server.
 6. A logcollecting/analyzing system according to claim 1, wherein the clientterminal device stores the collected log information in a desired form.7. A log collecting/analyzing system according to claim 1, wherein thestoring/analyzing unit is operable to pull out necessary information toanalyze from the log information transmitted from the client terminaldevice.
 8. A log collecting/analyzing system according to claim 1,wherein the log server is operable to manage the log informationtransmitted from the client terminal device independently for eachapplication program.
 9. A log collecting/analyzing system according toclaim 1, wherein the log server is operable to store the log informationtransmitted from the client terminal device in a desired form.
 10. A logcollecting/analyzing system according to claim 1, wherein the log serverand the client terminal device manage at least one of duration ofservice and a number of collection times for log collection.
 11. A logcollecting/analyzing system according to claim 1, further comprising: alog utilization terminal device for requesting desired log analyzedresults from the log server via a network and for receiving the desiredlog analyzed results transmitted from the log server.
 12. A method oflog collection, comprising: determining whether a logcollecting/analyzing system can be utilized; executing at least oneapplication program that utilizes the log collecting/analyzing system ifit is determined that the log collecting/analyzing system can beutilized; collecting a log generated by the log collecting/analyzingsystem at the time the at least one application program is executed; andmanaging information on the log independently for each applicationprogram.
 13. A method of log collection according to claim 12, whereinthe managing step further comprises managing the information on the logusing a tree structure consisting of nodes and elements.
 14. A method oflog collection according to claim 12, further comprising: transmittingan un-transmitted log to a log server via a network if it is determinedthat the log collecting/analyzing system can be utilized; accumulatingthe un-transmitted log if the network is incapable of transmitting theun-transmitted log; and transmitting the accumulated un-transmitted logto the log server when the network is capable of transmitting theun-transmitted log.
 15. A recording medium recorded with a logcollection program to be executed on a computer, the program comprising:determining whether a log collecting/analyzing system can be utilized;executing at least one application program that utilizes the logcollecting/analyzing system if it is determined that the logcollecting/analyzing system can be utilized; collecting a log generatedby the log collecting/analyzing system at the time the at least oneapplication program is executed; and managing information on the logindependently for each application program.
 16. A method of loganalysis, comprising: receiving log information transmitted from a logcollection terminal device via a network; storing the received loginformation; analyzing the stored log information utilizing a loganalysis interface to produce an analyzed result; and storing theanalyzed result.
 17. A method of log analysis according to claim 16,further comprising: analyzing the stored log information for eachapplication program utilizing a database which is provided with a logmanagement database for managing at least from which log applicationprogram the log user utilizes the log information, a log storagedatabase for managing log information registered in a log applicationprogram and a log analyzed result management database for managinganalyzed log information.
 18. A recording medium recorded with a loganalysis program to be executed on a computer, the program comprising:receiving log information transmitted from a log collection terminaldevice via a network; storing the received log information; analyzingthe stored log information utilizing a log analysis interface to producean analyzed result; and storing the analyzed result.
 19. A logcollecting device, comprising: an operating system for operating a logcollecting/analyzing system; an application program that utilizes thelog collecting/analyzing system; and a log system basic functionprocessing unit for providing a basic function of the logcollecting/analyzing system, wherein the log system basic functionprocessing unit includes a log interface management unit for managing alog interface for generating log information at the time the applicationprogram is executed, a log object processing unit for controlling afunction of a log object consisting of log management information andlog data, a log object transmission unit for controlling processing fortransmitting the log information to a log server and a log objectmanagement unit for managing the log object.
 20. A log collecting deviceaccording to claim 19, wherein the log object consists of the logmanagement information having a log application ID specifying anapplication program that utilizes the log collecting/analyzing systemand a log user ID indicating which user a log belongs to, and log datahaving a tree structure consisting of nodes and elements.
 21. A loganalyzing device, comprising: an operating system for operating a loganalyzing system; and a log server function processing unit foranalyzing received log information and storing an analyzed result,wherein the log server function processing unit includes a log analysisinterface management unit for managing a log analysis interface, a logobject analysis unit for analyzing the received log information, a logobject reception unit for controlling a function for receiving loginformation transmitted from a log collection terminal device via anetwork and a log analyzed result management unit for storing theanalyzed result.
 22. A log analyzing device according to claim 21,further comprising: a log management database for managing at least fromwhich application program the log user utilizes the log information; alog storage database for managing log information registered in theapplication program; and a log analyzed result management database formanaging the analyzed log information.
 23. A log collection terminaldevice, comprising: a collecting unit operable to collect loginformation; and a transmitter operable to transmit collected loginformation to a log server via a network.
 24. A log collection terminaldevice according to claim 23, further comprising: a forming unitoperable to form a basic structure of a log; and a generating unitoperable to generate desired log information from the basic structure ofthe log.
 25. A log collection terminal device according to claim 24,wherein the forming unit is operable to form a tree structure consistingof nodes and elements as the basic structure of the log, and thegenerating unit is operable to generate the desired log informationhierarchically utilizing the tree structure.
 26. A log collectionterminal device according to claim 23, wherein the collected loginformation is managed independently for each application program.
 27. Alog collection terminal device according to claim 23, wherein thecollected log information is maintained under an off-line conditionexcept for log information transmission processing for the log server.28. A log collection terminal device according to claim 23, wherein thecollected log information is maintained in a desired form.
 29. A logcollection terminal device according to claim 23, further comprising:means for managing at least one of duration of service of the logcollection and a number of collection times for log collection.
 30. Alog server, comprising: a receiver operable to receive log informationtransmitted from a log collection terminal device; and a storing andanalyzing unit operable to store the received log information and topull out necessary information to analyze from the received loginformation.
 31. A log server according to claim 30, wherein thereceived log information is independently managed for each applicationprogram.
 32. A log server according to claim 30, wherein the receivedlog information is stored in a desired form.
 33. The log serveraccording to claim 30, further comprising: means for managing at leastone of duration of service of log collection and a number of collectiontimes for the log collection.
 34. The log server according to claim 30,further comprising: a transmitter operable to transmit an analyzedresult to a log utilizing terminal device.
 35. A logcollecting/analyzing system, comprising: a client terminal device havinga collecting unit operable to collect log information and a transmitteroperable to transmit the collected log information to a log server via anetwork; and a log server having a storing/analyzing unit for storingand analyzing the log information transmitted from the client terminaldevice.